Privacy Policy

Who we are

TUC (“we”, “us”) provides the Suggestion Box, a platform for transparent organizational decisions. For the content your organization puts into the product, your organization is the controller and we act as its processor; for your account and billing data, we are the controller.

Data we collect

Account data (your name, work email, and a hash of your password), organization data (organization name, members, and roles), the content you submit (suggestions, comments, and decisions), and billing data handled by our payment processor.

We also collect basic technical logs needed to run and secure the service.

How we use your data

To provide and secure the Suggestion Box, authenticate you, process payments, send service communications, and meet legal obligations. We do not sell your personal data, and we do not use it for third-party advertising.

Legal bases

Where the GDPR or similar laws apply, we rely on the performance of our contract with you, our legitimate interests in running a secure service, your consent where required, and compliance with legal obligations.

Sharing and subprocessors

We share personal data only with the trusted third parties that help us run the service (our “subprocessors”), each under a data-processing agreement. The current list is on our Subprocessors page at /legal/subprocessors.

Data retention

We keep personal data for as long as your organization has an active account and as needed to provide the service, then delete or anonymize it within a reasonable period, unless a longer period is required by law.

Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object or withdraw consent. To exercise these rights, contact us or your organization’s administrator.

International transfers

We and our subprocessors may process data in countries other than yours, including the United States. Where required, we put appropriate safeguards in place for such transfers.

Security

We protect your data with encryption in transit, access controls, tenant isolation, and audited privileged actions. No system is perfectly secure, but we work to protect your information and to notify you of incidents where required.

Children

The Suggestion Box is for use by organizations and is not directed to children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version here and update the date above; we will communicate material changes where appropriate.

Contact us

Questions about this policy or your data? Contact us at privacy@… (placeholder, legal to confirm the contact details).